To detect the deployment of large language models for malicious use cases (e.g., fake content creation or academic plagiarism), several approaches have recently been proposed for identifying AI-generated text via watermarks or statistical irregularities. How robust are these detection algorithms to paraphrases of AI-generated text? To stress test these detectors, we first train an 11B parameter paraphrase generation model (DIPPER) that can paraphrase paragraphs, optionally leveraging surrounding text (e.g., user-written prompts) as context. DIPPER also uses scalar knobs to control the amount of lexical diversity and reordering in the paraphrases. Paraphrasing text generated by three large language models (including GPT3.5-davinci-003) with DIPPER successfully evades several detectors, including watermarking, GPTZero, DetectGPT, and OpenAI's text classifier. For example, DIPPER drops the detection accuracy of DetectGPT from 70.3% to 4.6% (at a constant false positive rate of 1%), without appreciably modifying the input semantics. To increase the robustness of AI-generated text detection to paraphrase attacks, we introduce a simple defense that relies on retrieving semantically-similar generations and must be maintained by a language model API provider. Given a candidate text, our algorithm searches a database of sequences previously generated by the API, looking for sequences that match the candidate text within a certain threshold. We empirically verify our defense using a database of 15M generations from a fine-tuned T5-XXL model and find that it can detect 80% to 97% of paraphrased generations across different settings, while only classifying 1% of human-written sequences as AI-generated. We will open source our code, model and data for future research.

翻译：为检测大型语言模型被用于恶意用途（如伪造内容生成或学术剽窃），近期研究者提出了多种通过水印或统计异常性识别AI生成文本的方法。这些检测算法对AI生成文本的改写操作鲁棒性如何？为对这些检测器进行压力测试，我们首先训练了一个110亿参数的改写生成模型（DIPPER），该模型能够改写段落，并可选地利用周围文本（例如用户编写的提示）作为上下文。DIPPER还使用标量旋钮来控制改写中的词汇多样性和重排程度。利用DIPPER对三个大型语言模型（包括GPT3.5-davinci-003）生成的文本进行改写，成功规避了包括水印、GPTZero、DetectGPT和OpenAI文本分类器在内的多种检测器。例如，在保持1%恒定误报率的情况下，DIPPER将DetectGPT的检测准确率从70.3%降至4.6%，同时未明显改变输入语义。为提升AI生成文本检测对改写攻击的鲁棒性，我们引入了一种简单防御方法，该方法依赖于检索语义相似的生成结果，并需由语言模型API提供方维护。给定候选文本，我们的算法在先前由API生成的序列数据库中搜索与候选文本匹配度达到特定阈值的序列。我们使用微调后的T5-XXL模型生成的1500万条序列数据库进行了实证验证，发现该方法在不同设置下能检测出80%至97%的改写生成文本，同时仅将1%的人类编写序列误分类为AI生成。我们将开源代码、模型及数据以供后续研究。